> If I make a string: '<P>' . $var . '</P>' I'd say don't do that, refactor into templates instead. With your preferred approach to generating markup, you're l

> If I make a string: '<P>' . $var . '</P>' I'd say don't do that, refactor into templates instead. With your preferred approach to generating markup, you're largely on your own in protecting against XSS. Hopefully all the developers using your code are awesome at spotting and pro-actively dealing with XSS issues. Still, with a HTML escape everything default, either turn it off, or use a raw "I know what I'm doing" method instead.